On a desk in October sat a Switch 1, a Switch 2, two small boxes that turn a console's HDMI output and USB input into something a program can see and press, and a Bluetooth lever bought from Amazon. The lever's only job was to press the power button. The program on the other end of the cables was OpenAI's Codex, and the researcher who built the rig, Sammy Hajhamid, wrote that he set it up "so Codex could, ideally, jailbreak the Switch 2 without me."

Two weeks later he published ns2jb, which he describes as "a software-only, tethered jailbreak for the Switch 2" on the current firmware and, "to my knowledge, the first such exploit" for the console. The write-up sat at the top of Hacker News for most of a day. Kotaku, Vice, Nintendo Life and XDA covered it on October 22. By the end of that day the $25 program the exploit enters through, a Switch 1 title called SmileBASIC 4, had disappeared from the eShop in every region anyone checked. Nintendo has said nothing.

The line doing the rounds is that an AI jailbroke the Switch 2 in two weeks. I wrote last week that compiled code stopped keeping secrets this month, with the PlayStation as the canary. This is the same story one layer down, at the hardware lock, and the line is still wrong in a way that matters if you sell anything with a lock on it.

The agent did not break the Switch 2. It turned a 16-month lock into a two-week problem. And the lock was never the thing Nintendo sells.

What the agent did, and what it did not

Start with the researcher's own account, because it is more careful than the headlines built on it. Codex, he writes, "found a useful 32-bit integer overflow in the interpreter" of SmileBASIC, a programming toy that runs on both consoles. That was the way in. The second bug, a buffer overflow in the way the console's file-system service normalizes paths, is described without saying who found it. A third approach, through the console's browser engine, "did not succeed." The caption on the rig, "set a goal to jailbreak the switch 2. make no mistakes," got so many questions that he added an edit: "No, it's just a silly caption." The goal he actually gave the agent, code execution in user space, "didn't succeed." The jailbreak itself "took substantial effort for ~2 weeks." The Mario Kart World mod shown in the video, custom characters on a Switch 2 exclusive, was "entirely vibecoded in a day, and was just for fun."

Then look at what shipped. The exploit is tethered, so it is lost every time the console powers off. It runs code as the built-in file-system service, which is a long way from the kernel. The repository's own readme says it "does not install custom firmware or persistence." You need to own SmileBASIC 4, be on firmware 23.0.1, and have a computer on the same network. Vice put it plainly: the footage "does not establish that the console's security protections have been fully bypassed." TheGamer said you cannot run custom firmware or pirate games with it.

So the honest sentence is this. A skilled researcher found a bug with an agent's help, built a chain by hand over two weeks, and released a foothold. That is real, and it is not what "Codex jailbroke the Switch 2" means to the people repeating it.

Sixteen months, then two weeks

What makes the story worth more than a correction is the clock. The Switch 2 launched on June 5, 2025. By June 30 this year Nintendo had sold 23.68 million of them and 58.17 million games. The current firmware, 23.0.1, has been out since September 30. Sixteen months with no public software exploit is a good run for a console. The original Switch lasted about 13 months before Fusée Gelée, a bootloader bug Nintendo could not patch on the 14.8 million units already shipped, because it lived in silicon.

The difference this time is not the model. It is the desk. Two KVMs let the agent send controller inputs over USB and watch the screen over HDMI. The Bluetooth lever let it reboot a crashed console without a human in the room. The researcher's harness turned a problem that needs a person sitting at the hardware into one that runs while the person is asleep, and then he did the hard parts himself. That is the pattern from last week's piece again: the cost of reading what you own has fallen to a coding subscription and some cables. What took a hardware community a year now takes one researcher a fortnight, and the next one starts from his published chain.

This is the part the engineers on Hacker News argued about for 300 comments, and the argument was not whether it was impressive. It was how much of it was the agent. The researcher's own answer is "some." The answer that matters for anyone who ships a locked device is that it does not matter. Months of lock became weeks, with or without the credit.

The lock was never the business

Here is where I disagree with the people treating this as a security story, and I say that as someone who prices and packages software for a living, in payments, an industry that has shipped locked terminals for 40 years.

Look at where Nintendo's money comes from. In the April to June quarter, digital was 61.5 percent of software sales, up 90 percent year on year to 132.7 billion yen. Fifty-eight million games on 24 million consoles is two and a half games per machine, and most of them bought through a store Nintendo runs. The physical cards for Switch 2 are often game-key cards, which a Nintendo executive told GameSpot are "not tied to an account or anything" and simply unlock a download. The user agreement lets Nintendo render a console "permanently unusable," and the support site lists the error code a banned machine shows. In September a ban wave hit innocent owners and was reversed as a server fault, which tells you the ban is a live instrument, not a threat.

That is the business: a store, an account, and a record of what was paid for and on which machine. The lock on the console protects the margin on time. It keeps the first year or two clean so the store can get its habits in. It was never what the 61.5 percent sits on.

A console maker is a store with a plastic front end. The lock buys the store time. The account and the ledger are what it defends.

Nintendo's own behavior says it knows this. Its response to the first Switch 2 exploit was not a statement or a firmware patch. It was to delist a $25 program from the store, which Nintendo Life and GoNintendo reported on the same day, and which changes nothing for anyone who already owns it. The store is the lever Nintendo can still pull. When the lock really goes, the answers it reaches for will be the ones it has used before: Gary Bowser of Team Xecuter got 40 months and $14.5 million in restitution and settlement; the Yuzu emulator's makers paid $2.4 million and stopped. The law, the account and the store. Not the silicon.

The legal line is the same one as last week. Exploiting a console you own, with a program you bought, is the owner's side of a boundary that has held since Sega v. Accolade. Shipping a publisher's games, a piracy store or a circumvention product is the other side, and Section 1201 bans circumvention regardless of whether any copyright is infringed. The researcher is on the first side. The forks that will follow him are where the fight is, and it will be fought with accounts and lawyers, not firmware.

What I would change this week, by job

If you ship hardware with a lock on it. Budget the lock as buying months, not years, and plan the product so that when it goes, the revenue does not. That means the thing customers pay for lives behind the account, the store and a record of what was bought, where you can see it and act on it. Nintendo's digital share is the model. A payment terminal that only works because its firmware is secret is the anti-model, and there are a great many of them.

If you set the pricing. Stop pricing the lock. Price what the lock was protecting: the catalog, the service, the thing that updates. A customer who jailbreaks a console they own has not stopped being a customer. The ban wave in September is what it looks like when you forget that.

If you run security. The harness is now the threat model, not the model. Assume an agent with a KVM and a power switch can keep trying all night, and that the first person to get a foothold will publish the chain for the next thousand. Fusée Gelée took a community a year. This took one person two weeks. The next one starts from the readme.

What to watch

Whether Nintendo says anything before its second-quarter results in early November, which will also replace the 23.68 million figure. Whether firmware 23.0.2 arrives, and how fast the chain is adapted when it does. Whether SmileBASIC 4 stays available in Japan, the one store the delisting had not visibly reached. And the only development that would change my reading: a persistent exploit and custom firmware, followed by a digital software number that goes down. I expect the first before the console's second birthday in June 2027. I do not expect the second.

Sources

If the lock on your product buys months rather than years now, what is the thing customers are actually paying you for, and can you see it in a ledger?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.